Sergi Ortega M.

2 x Father, Engineer, casual MTB Rider. Interests: Computer science, engineering, gamedev, crypto trading, entrepreneurship & deep space. Langs: ES / EN / CAT

[Aakash Gupta @aakashgupta]

North Korean intelligence agents built an entire fake company to compromise one JavaScript developer. And it worked.

UNC1069 didn't hack Axios. They befriended its maintainer. They cloned a real company founder's identity, built a branded Slack workspace with fake employee profiles and LinkedIn post channels, then scheduled a Microsoft Teams call with what appeared to be a full team. During the call, a fake error message said his system needed an update. He installed it. That update was the RAT.

From one developer's laptop, they had everything: npm credentials, publishing access, the keys to a package installed in 80% of cloud environments. Axios gets 100 million downloads per week. The attackers published two poisoned versions at 12:21 AM UTC on a Sunday night, tagging both the latest and legacy branches within 39 minutes. The malicious dependency had been pre-staged 18 hours earlier with a clean decoy version to build registry history. Three separate RAT payloads were pre-built for macOS, Windows, and Linux. The malware self-deleted after execution to erase forensic evidence.

The poisoned versions were live for about three hours before npm pulled them. Huntress observed 135 endpoints across all operating systems calling the attacker's command-and-control server during that window. Wiz found the malicious versions in roughly 3% of environments scanned. Every affected machine needs full credential rotation: npm tokens, AWS keys, SSH keys, CI/CD secrets, everything in .env files.

The part that keeps getting worse: this isn't isolated. The same threat cluster compromised Trivy (a security scanner), KICS, LiteLLM, and multiple GitHub Actions in the two weeks before Axios. Google estimates hundreds of thousands of stolen secrets are now circulating from these combined attacks. The maintainer had 2FA enabled. He said himself: "I have 2FA/MFA on practically everything." The exact method of token compromise is still undetermined.

One person. One fake Teams call. 100 million weekly downloads weaponized in under three hours. The npm ecosystem runs on mass trust in individual maintainers who volunteer their time, and North Korean intelligence now has a repeatable playbook for turning that trust into a delivery mechanism.

[Nostalgia @NostalgiaFolder]

Name the game

[El Estoico | Filosofía @ElArteDeVivir__]

La felicidad es paz, no placer. - Will Smith

[Sergi Ortega M. @sortegam]

That's so true 🤣

[Melkey @MelkeyDev]

Developers using NextJS, Clerk, Prisma, Tailwind, ShadCdn, Stripe, tRPC, Zod, Perl, Python, Edge Functions + Supabase for their 0 user side projects

[Sergi Ortega M. @sortegam]

This is what Starlink was intended for.

[Sergi Ortega M. @sortegam]

Today I received and set up a @Starlink kit with the roaming plan. I have to say that I'm really impressed by the speed, latency and stability of the service.
Getting an average of:
⬇️250 Mbps ⬆️35 Mbps 🕔 30 ms latency

Really good job, Starlink Team!

[El Estoico | Filosofía @ElArteDeVivir__]

Cambia el alcohol por agua.
Cambia Netflix por podcasts.
Cambia las quejas por gratitud.
Cambia gastar dinero por invertir.
Cambia trasnochar por madrugar.
Cambia influencers por creadores.
Cambia el sobrepensar por acción.
Cambia amigos tóxicos por mentores.

[Sergi Ortega M. @sortegam]

Alone day, Godot day! Time to dive into the manual! 📔

[Sergi Ortega M. @sortegam]

@godotengine

[Sergi Ortega M. @sortegam]

Decompiling and reverse engineering a Godot game is a trivial task. If you're looking to increase the difficulty of this process, check out this awesome guide which provides useful tips to protect your project:

https://t.co/jJJHPxRC7O

#GodotEngine

[El Estoico | Filosofía @ElArteDeVivir__]

“La soledad es para mí una fuente de curación que hace que valga la pena vivir la vida. Hablar es a menudo un tormento para mí y necesito muchos días de silencio para recuperarme de la inutilidad de las palabras.”

- Carl Jung

[Sergi Ortega M. @sortegam]

If you have an old laptop, install Chromebook and give it to your kids.
Tip: Use Google Family Link to control what they can do, restrict access to dangerous stuff and control the time they spend in front of screens.
They'll boost their tech skills effortlessly.

[Mike Hoffmann @MikeHoffmann]

I found a guy who goes around the US asking 70 to 100-year-olds their:

• Biggest Regrets
• Biggest Lessons
• Advice to their younger self

Oddly enough, most of their answers are the same…

Here are my top 8:

[Sergi Ortega M. @sortegam]

Ojo! No digo que Godot sea mejor en todos los aspectos. A mi me gusta más por ciertos puntos en concreto. En otros puntos gana Unity de calle. Pero mi visión es que en un futuro, conforme la comunidad de Godot crezca, estudios de nueva creación lo adoptaran como engine principal.

[Sergi Ortega M. @sortegam]

#GodotEngine es lo que Blender es a día de hoy respecto a 3DSMax o Maya. Una herramienta Open Source con muchisima potencia y calidad capaz de competir con herramientas closed source. Si eres de los mios, solo-dev, que prioriza la velocidad y la Dev Experience: Godot > Unity 💫

[𝖪𝖾𝗇𝗂𝖺 𝗅𝗈 𝗁𝖺𝖼𝖾 𝗍𝗈𝖽𝗈 𝗆𝖺𝗅 @RelatocuriosoK]

Jugar al Tetris después de un evento traumático puede ayudar a prevenir los síntomas del estrés postraumático.

[Sergi Ortega M. @sortegam]

Interesting... seen on Linkedin.

[Riley Brown (rileyb3d) @rileyb3d]

What's the biggest lie you tell yourself?

[Sergi Ortega M. @sortegam]

@Segura_J_J Opino igual. Me decepcionó. Lo que más me gustó fue el render del dragon, pero a la misma vez es tan mala que entre escenas el dragon cambia de tamaño. Va de ser una abominable bestia del tamaño de un rascacielos a una lagartija con alas del tamaño de una furgoneta.